Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,268cataloged exploits
40,621CVEs with public exploitation
24,696lab-tested
AllReferência 26,377Exploit-DB 24,489GitHub PoC 18,117VulnCheck XDB 10,169Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-82185
WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset
33RISK
open ↗Referência
CVE-2026-90803
GNU Binutils ld elf64-x86-64.c elf_x86_64_relocate_section buffer overflow
33RISK
open ↗Referência
CVE-2026-83545
CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON
33RISK
open ↗Referência
CVE-2026-90712
Gitlawb openclaude xAI OAuth Callback xaiOAuthCallback.ts waitForCallback denial of service
33RISK
open ↗Referência
CVE-2026-95924
SourceCodester Online Reviewer Management System btn_functions.php add sql injection
33RISK
open ↗Referência
CVE-2026-85123
Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion
33RISK
open ↗Referência
CVE-2026-96763
kvcache-ai mooncake MountSegment Request Processing segment.cpp access control
33RISK
open ↗Referência
CVE-2026-90621
ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injection
33RISK
open ↗Referência
CVE-2026-96601
Abdurrab5 online-makeup-store Admin Login index.php sql injection
33RISK
open ↗Referência
CVE-2026-16966
Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content
33RISK
open ↗Referência
CVE-2026-75793
SureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login
33RISK
open ↗Referência
CVE-2017-5753
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of
55RISK
open ↗Referência
CVE-2026-82700
code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting
33RISK
open ↗Referência
CVE-2026-90923
Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion
33RISK
open ↗Referência
CVE-2026-90615
SourceCodester Class and Exam Timetabling System subject1.php cross site scripting
33RISK
open ↗Referência
CVE-2026-84901
Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization
33RISK
open ↗Referência
CVE-2026-97877
zhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded password
33RISK
open ↗Referência
CVE-2026-96272
ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php
41RISK
open ↗Referência
CVE-2026-95868
AdithyaYelloju Restaurant-Management-System Search Form display_menu.php mysqli_query sql injection
33RISK
open ↗Referência
CVE-2026-90697
SourceCodester Inventory Management System invoice.php authorization
33RISK
open ↗Referência
CVE-2026-90696
SourceCodester Inventory Management System Product Management products_handler.php cross site scripting
33RISK
open ↗Referência
CVE-2026-80113
PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary Bit Clear via DirectIo64.sys IOCTL
33RISK
open ↗Referência
CVE-2026-81197
MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route
33RISK
open ↗Referência
CVE-2026-82906
sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.